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Recognizing Possible Terrorist 911 Calls: Indicators and Considerations for an Effective Response 


In addition to martyrdom videos, manifestos, and social media posts, terrorists have used 911 calls to announce their allegiance to terrorist groups, 
highlighting grievances, and using their perceived ideology to justify their violent acts. Moreover, terrorists have targeted first responders, and may even 
call 911 to lure a target to a specific location for an attack, exploiting the requirement for first responders to respond quickly to a call for service whenever 
and wherever required. 911 operators and dispatchers familiarizing themselves with mobilization indicators and terms that terrorists have historically used 


may better position them to identify luring tactics, recognize a potential terrorist, and provide intelligence and warning to first responders. 


In January 2019, an Arizona-based man called 911 twice and 
stated that he wanted to speak with a law enforcement officer 
in person. During a second 911 call, the man declared his 
allegiance to ISIS and said he would “...like to do something 
in protest for, uhh, the people suffering in Palestine and in 
the Middle East.” After beginning a conversation with the 
responding officer, the man began throwing rocks, then 
brandished a knife, and advanced toward the officer. The 
officer ordered him to cease and repeated commands for him 
to drop his weapon. After he ignored the commands, the officer 
discharged his firearm, incapacitating him. Subsequently, the 
man was taken into custody by the officer and is now facing 
aggravated assault and terrorism charges. 


In June 2016, a Florida-based man called 911 during his 
attack at a nightclub, during which he killed 49 and injured at 
least 50 others. When asked his name by the 911 operator, 
the man replied, “My name is, | pledge of allegiance to Abu 
Bakr al-Baghdadi of the Islamic State.” While speaking with a 
police negotiator a short time later, he said, “Tell America to 
stop bombing Syria and Iraq; they’re killing a lot of innocent 
people.” Authorities shot and killed the subject during 

the attack. 


PUBLIC SAFETY CONSIDERATIONS: A suspected terrorist who calls 
911 may pose an unknown threat to the public as well as to first 
responders, for example an active shooter, IED, hostage situation, 
knife attack, or a vehicle-ramming attack. To mitigate the threat, 
911 call centers and first responders are encouraged to integrate 
the considerations located in the following graphic into their 
security measures and incident-response plans: 


NOTE: Terrorist tactics are constantly evolving, asymmetrical, and often 
do not fit traditional 911 operators’ or dispatchers’ response protocols 
and scripts. 911 centers are encouraged to provide employees with CT 
training and scenarios that enrich critical thinking skills. The employees 
should also participate with first responders during CT training events and 
exercises to better understand the roles, missions, and capabilities. 


911 OPERATORS & DISPATCHERS: 


Learn the mobilization indicators and 
terms used by violent extremists, 

as well as common grievances 
highlighted in this product. 


Provide training and resources that 
support cultural competency and 
multilingual capacity to reduce 
language barriers and to ensure 
threats are understood and result in 
the appropriate response. 


Develop forms or prompts that assist 
in noting what the caller said, similar 
to a bomb-threat checklist, with a 
section that prompts the call taker to 
note language potentially indicative of 
mobilization toward violence. 


Ensure dispatchers relay pertinent 
information to responders to ensure 
awareness of a potential terrorist 
threat from a 911 caller. 


Understand that incoming calls, to 
include 911 calls, may be critical 
evidence; preserve for further vetting. 


and authorities. 


ALL: 


Establish a protocol for handling 
suspected terrorists once a 

911 operator or dispatcher has 
recognized the indicators, and ensure 
all personnel understand the process. 
The protocol will expedite the relaying 
of pertinent information to first 
responders in order to safely respond 
to and mitigate the threat. 


Promote interagency coordination, to 
include other federal, state, and local 
authorities, as they may be able to 
assist in providing critical skills and 
additional specialized resources. 


Within agency policy, and as 
resources allow, query the 
complainant by running the threat 
through the FBI National Crime 
Information Center (NCIC), regional 
fusion center, and other criminal 
databases, to better assess 

the situation. 


SCOPE: This product assists 911 operators and dispatchers, as well as first responders, who 
may have limited terrorism training, in understanding indicators and implementing proactive 
measures if a potential terrorist places a call to 911 before or during an attack. This information 
is a starting point to encourage stakeholders to collaborate and seek further guidance, resources, 


FIRST RESPONDERS: 


e Due to the potential threat of weapons 
and explosives, responders should 
cautiously approach the scene and 
assess the situation to determine 
the best manner to mitigate the 
threat. As a reminder, the handling 
of any device may potentially cause 
injury and damage, and contaminate 
forensic evidence. 


“What-if” scenarios: run through 
scenarios and plan for what might 
occur, as such action may be key to 
changing, gaining, and maintaining a 
tactical advantage. For example, the 
officer can request the dispatcher 
tell the complainant to exit their 
residence to meet the patrol unit 

to gain a position advantage and 
prevent the officer from a potentially 
premeditated trap. 


Ensure the radio is readily accessible 
and set to the proper channel to 
communicate with dispatchers, and 
practice radio etiquette to prevent 
radio traffic from hindering calls for 
additional resources. This may include 
a dedicated or encrypted radio 
channel specific to the incident. 


NOTICE: This product was developed by the Joint Counterterrorism Assessment Team (JCAT), which is a collaboration by NCTC, DHS, the FBI, and 
state, local, tribal, and territorial government personnel to improve information sharing and enhance public safety. The product promotes coordination 
among intergovernmental authorities and the private sector in identifying, preventing, and responding to terrorist activities. Consider the enclosed 
information within the context of existing laws, authorities, agreements, policies or procedures. For additional information contact us at JCAT@NCTC.GOV. 
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Recognizing Possible Terrorist 911 Calls: Indicators and Considerations for an Effective Response (continued) 


AWARENESS OF THE INFORMATION YOU MAY POSSESS: In addition to receiving, 
prioritizing, providing instructions on life-saving emergency medical interventions, 
and dispatching emergency personnel, 911 operators and dispatchers are 
responsible for helping callers remain calm enough to provide the pertinent 
information that first responders need to understand the full scope of the 
situation. When 911 operators and dispatchers gather, process, and relay a caller’s 
allegiance, grievance, motivation, and warning behaviors, first responders will have 
greater situational awareness when they arrive on scene. To assist in this process, 
the following is a generalized, nonexhaustive list of allegiances, grievances, and 
terms that terrorists have used before and during an attack. The list facilitates the 
evaluation of a potential threat given the totality of circumstances. 


IMPORTANT: Some terms are religious in nature, have multiple meanings, are widely used 
around the world, and may not indicate that someone is a terrorist. Call takers should 
evaluate the use of this language in the context of what the caller is communicating, as 
no single behavior is predictive of targeted violence. 


ALLEGIANCE: Callers may pledge allegiance to terrorist groups, including ISIS, 
al-Qa‘ida, al-Shabaab, HAMAS, or Lashkar-e-Tayyiba, so the group may claim credit. 
They may also mention ideologues who advocate violence, for example Osama bin 
Laden, Anwar al-Aulaqi, Abdullah Azzam, Sheikh Omar Abdel-Rahman, Abu Muhamad 
al-Adnani, Abu Bakr al-Baghdadi, Abu Musab al-Zarqawi, and Shaikh Abdullah 
al-Faisal. Terrorists who have pledged their allegiance to foreign terrorist organizations 
(FTOs) have also used the following phrases before or during a terrorist attack: 


e | give bay‘ah (allegiance) to amir ul Mu‘mineen (the leader of the believers). 
e | pledge allegiance to Abu Bakr al-Baghdadi of the Islamic State. 
e | owe my allegiance to the Islamic State of Iraq and Syria. 


GRIEVANCES: In addition to pledging allegiance to a terrorist group before an attack, 
terrorists also desire to express their grievances. There are generally a limited 
number of motives for targeted violence: 


© Quest for justice (as defined by the offender). 

e Revenge for a perceived injury or grievance. 

¢ Desire for notoriety or recognition. 

e Desire to solve a problem that is perceived to be unbearable. 
e Desire to kill or be killed. 


In both martyrdom videos and 911 calls, terrorists have claimed their attacks 
were justified because of one or more grievances. Terrorists have expressed 
perceptions that: 


e America is at war with Islam. 

e America supports Israel, and helps to starve and oppress Palestinians. 

¢ America bombs Muslim countries like Afghanistan, Iraq, Somalia, Syria (Sham). 
e America kills Muslim women and children. 


e America invaded or forced democracy on Iraq and Afghanistan. 


e The airstrike that killed 


triggered this. 


e America supports tyrannical—or taghut (idolatry, paganism)—governments in 
the Middle East. 


Terrorists often place the blame on the people of a country for their attack. They will 
claim the citizens are responsible for their elected government which is oppressing 
Muslims around the world. Terrorists may state that they are simply defending their 
own people, righteous in their actions, and are “soldiers of Allah (God).” 


OTHER TERMS AND PHRASES: Terrorists have used the following terms and phrases 
before an attack. The list is not exhaustive. The use of the terms and phrases 
does not signify that a caller is threatening violence. They are presented to assist 
911 operators and dispatchers in evaluating the context of a call: 


e Allahu Akbar! — God is the Greatest! 


e al-Qa‘ida and their associated branches, for example al-Qa‘ida in the Arabian 
Peninsula (AQAP). 


e Ash-Sham — Refers to the area of the Levant, typically understood as Lebanon, 
Syria, and parts of Israel, Jordan, and the West Bank. 


e Bay‘ah or bay‘at — An oath of allegiance or loyalty to a ruler or caliph (leader). 


e Bismallah, al-Rahman, al-Rahim — Translates as “In the name of God, the 
Merciful, the Compassionate.” The phrase is sometimes used as an invocation 
before embarking on a significant act or undertaking. Terrorists have used the 
term at the beginning of end-of-life preparations. 


e Caliph — Successor; leader; used by violent extremist groups who seek to 
reestablish their Islamic state. 


¢ Caliphate — An Islamic state ruled by caliph. May also refer to ISIS. 


e Crusaders — Reference to Christians, and generally America and the West, to 
include Europe. 


¢ Dabig— Online magazine affiliated with ISIS. 


e Dar al-harb — House of war; often cited as the West, or non-Islamic area; 
“Abode of war,” non-Muslim territory. Implies an area where “Muslims are not 
able to practice their religion freely.” 


e Dar al-kufr — Land of the infidel or the West. 
¢ Dawla — State or dynasty. May also refer to ISIS. 


¢ Die in your rage! — A popular terrorist taunt to the West, preceding and following 
terrorist attacks. 


e Establish the sharia — Terrorist organizations seek to establish sharia around 
the world. 


¢ Green Birds — Belief that a martyr’s soul is kept in the heart of a green bird to 
fly around in paradise. 


e Haram — Forbidden or sinful under sharia and punishable. 


¢ Infidel — Nonbeliever, non-Muslim, atheist. Terrorists may use the term as 
justification for targeting individuals. 


¢ Inspire — Online magazine affiliated with AQAP. 


e Islamic State in Iraq/Syria (ISIS) and their associated branches, for example 
ISIS-Khorasan, ISIS-Sinai. 


e Jannah/Jannat al-Firdous — Highest level of paradise. If a caller speaks about 
going to paradise, that may be an indicator of his or her intentions. 


e Jihad/Jihad Fi Sabillah — Striving or exertion for a noble cause. FTOs utilize the 
phrase to justify violence in defense of their interpretation of Islam. 


¢ Kafir/kaafir (singular), kufaar/kuffar (plural) — Nonbeliever, non-Muslim, atheist. 
Terrorists may use the term as justification for targeting individuals. 


¢ Khalif or Khalifah — Successor or leader; used by violent extremist groups who 
seek to re-establish their Islamic state. 


e Lions of Tawhid (belief in Allah and no other) - Common reference for 
ISIS fighters. 


¢ Mujahid — Muslim martyr. If a 911 caller self-identifies with this term, the 
individual may be planning to carry out an attack. 


¢ Qisas — The principle of equal retaliation. 
¢ Rumiyah — Online magazine affiliated with ISIS. 


© Shahid — A martyr. If a 911 caller self-identifies with this term, the individual 
may be planning to carry out an attack. 


e Sham — Refers to Syria. 
e Sharia — The law of Allah (not manmade laws); that governs all aspects of life. 


¢ Shirk — Worship of anyone or anything aside from Allah; Islamic concept of 
the sin of polytheism and idolatry. Those guilty of this sin will not see paradise 
when they die, according to strict interpretations of Islam; this concept is 
embraced by terrorist groups. Opposite of tawhid (belief in Allah and no other). 


e Soldier of Allah — One who is engaged in jihad or is a martyr. If a 911 caller 
self-identifies with one of these terms, the individual may be planning to carry 
out an attack. 


¢ Tawhid — Belief in Allah and no other (this encompasses everything for Islamic 
terrorists). Terrorist groups have used this in reference that one is either with 
ISIS or is not. 


RESOURCES: HOMEGROWN VIOLENT EXTREMIST MOBILIZATION INDICATORS 
(2019 EDITION) is available at https://www.dni.gov/files/NCTC/documents/ 
news_documents/NCTC-FBI-DHS-HVE-Mobilization-Indicators-Booklet-2019.pdf 


NOTICE: This product was developed by the Joint Counterterrorism Assessment Team (JCAT), which is a collaboration by NCTC, DHS, the FBI, and 
state, local, tribal, and territorial government personnel to improve information sharing and enhance public safety. The product promotes coordination 
among intergovernmental authorities and the private sector in identifying, preventing, and responding to terrorist activities. Consider the enclosed 
information within the context of existing laws, authorities, agreements, policies or procedures. For additional information contact us at JCAT@NCTC.GOV. 
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(U) JCAT MISSION: To improve information sharing and enhance public safety. In coordination with the FBI and DHS, 
collaborate with other members of the IC to research, produce, and disseminate counterterrorism (CT) intelligence products 
for federal, state, local, tribal and territorial government agencies and the private sector. Advocate for the CT intelligence 
requirements and needs of these partners throughout the IC. 


NAME and/or ORG: 


DISCIPLINE: J te MM FIRE MM ems (MM HEATH MMM anaysis (MM PRIVATESECTOR ~=DATE: Pe 


and) D060 ONE NCTC-FBI-DHS (U) First Responder's Toolbox - Recognizing Possible Terrorist 911 


— 
P 0 0 R “~ ‘or (eo) 
\ 


ADDITIONAL COMMENTS, SUGGESTIONS, OR QUESTIONS. HOW DOES JCAT MAKE PRODUCTS BETTER? 


WHAT TOPICS DO YOU RECOMMEND? 
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